Ranch Hand for Windows

Ranch Hand is the standalone deployment and lifecycle manager for RepoWrangler and the primary recommended Windows deployment path. Use it when you want a Windows interface to download and verify an immutable RepoWrangler release, create a secret-free deployment plan, run preflight and dry run, and apply a supported target without cloning the product source.

Ranch Hand v0.1.0-rc.30 is a Public Preview: publicly downloadable and intended for evaluation and feedback, but unsigned, not production-supported, and not GA. Every supported target now defaults to a real, persistent production-data deployment; demo mode is available only when you explicitly select it. You can choose the manual deployment recipes instead—especially for contribution, custom automation, or an unsupported topology. Cloning, forking, custom builds, GitHub Actions, Azure DevOps, and user-owned automation remain supported independently of Ranch Hand.

Download Ranch Hand

Download Ranch Hand v0.1.0-rc.30 for Windows (64-bit)

Version: v0.1.0-rc.30 · Size: 21,224,960 bytes · Public Preview · Published as an unsigned prerelease

Read the Public Preview release notes.

Unsigned Public Preview software

This executable is not Authenticode signed. Windows SmartScreen or your organization's application-control policy may warn or block it. Use it only on an explicitly authorized target, and never bypass an organizational security policy. This is not the future signed, generally available installer.

You do not need a GitHub account, Git, GitHub CLI, the RepoWrangler source repository, Node.js, Go, Azure CLI, Wrangler CLI, Docker CLI, or a local SSH executable to download and start Ranch Hand. WSL is required only for the local WSL Docker Compose target. Each target's other prerequisites are listed below.

Verify the download

Open PowerShell in the folder containing the executable and run:

Get-FileHash .\ranch-hand-v0.1.0-rc.30-windows-amd64.exe -Algorithm SHA256
Get-AuthenticodeSignature .\ranch-hand-v0.1.0-rc.30-windows-amd64.exe

Expected SHA-256:

3e79357df43911b785d88645eca7472c3cd1d4c5b1b9f1c6d1943bdda7752805

Expected Authenticode status: NotSigned.

Download the checksum file or download the SPDX SBOM. The source, build history, and provenance remain publicly auditable in the Ranch Hand project, but they are not required for normal use.

Launch it

Double-click ranch-hand-v0.1.0-rc.30-windows-amd64.exe. Ranch Hand binds a random port on 127.0.0.1, opens its interface in your default browser, and protects the session with a random one-time launch token. Keep the executable running while using the interface. Closing it stops only the local Ranch Hand control service; it does not stop a RepoWrangler deployment.

If live preflight reports that the WSL installation directory already exists and there is no active lifecycle record, launch rc.30 and select Inspect and remove Ranch Hand remnants below the blocked check. Ranch Hand removes only an exact marker-owned deployment, the strict legacy empty-marker pattern, or a completely empty dedicated directory. It leaves unknown content untouched and reruns preflight automatically.

RC30 presents an explicit Demo mode checkbox for every target, and it defaults off. With it off, Ranch Hand installs RepoWrangler in production data mode, generates the target's protected secrets, and opens or reports the real first-run onboarding location. Selecting it intentionally installs the mock-data profile. The mode choice is non-secret and stored in the deployment plan; generated secrets are not.

WSL services do not remain available merely because Docker is enabled through systemd. Ranch Hand makes persistent WSL hosting a prerequisite, preserves unrelated Windows .wslconfig settings, disables the WSL instance and VM idle shutdown timers, and restarts WSL once before deployment. RepoWrangler then remains available on 127.0.0.1:8080 without an open WSL terminal.

Ranch Hand fetches the current target-compatible RepoWrangler catalog and lists every available stable or preview release. It is not limited to RepoWrangler versions known when the Ranch Hand executable was built. Use Fetch available releases to refresh the catalog at any time.

For WSL and Remote Linux, Ranch Hand downloads the selected release's official versioned offline image archive, verifies its digest against that release's Sigstore provenance, validates the exact Docker tag and immutable image identities, and caches it. WSL loads the verified archive into the selected distribution's Docker Engine. Remote Linux streams it over the authenticated, host-key-pinned SSH connection. Compose runs the verified local image with pulls disabled, and Ranch Hand records the exact runtime image ID for lifecycle verification and recovery. A GitHub account, token, and registry login are not used. RC30 supports RepoWrangler v1.0.18, including the production Azure contract.

Fresh real-mode deployments choose GitHub or Microsoft Entra ID administrator identity before connecting repositories. Loopback and private-network GitHub App manifests omit webhook configuration that GitHub rejects unless the hook is reachable over public HTTPS; those deployments use scheduled and manual synchronization. Remote real-mode installation displays the exact private-LAN URL and its one-time setup token in the active Ranch Hand result.

What the current candidate supports

Target	What the target requires	Current boundary
Local Docker Compose — WSL	Installed WSL2 Ubuntu/Debian distribution	If Engine or Compose is missing, Ranch Hand offers to install it inside WSL, start Docker, grant user access, and rerun preflight. Demo mode is explicit and defaults off. Off generates protected local secrets and opens real provider setup; on uses mock data.
Local Docker Desktop	Windows Package Manager, or Docker Desktop running Linux containers	If absent, Ranch Hand offers to install Docker Desktop through winget and leaves installer, administrator approval, first-run terms, and startup interaction visible. The default is production data mode on persistent SQLite with generated and lifecycle-preserved secrets, loopback-only access, protected onboarding, and local lifecycle operations. Demo mode is explicit.
Azure Container Apps	Azure subscription, permission to create a dedicated resource group and ACA resources, a temporary ARM access token, and RepoWrangler v1.0.18 or newer	The default provisions a new dedicated resource group, Container App, dedicated PostgreSQL flexible server and database, secure Container App secret references, one-time setup token, and Azure-managed HTTPS. Demo mode is explicit. Azure resources incur charges. Existing-resource selection, custom domains, backup, and update remain open.
Cloudflare	Account ID, unused Worker and D1 names, workers.dev subdomain, and a scoped API token	The default provisions a new Worker and D1 database in production data mode, installs protected Worker secret bindings plus a one-time setup token, and verifies the exact mode over workers.dev HTTPS. Demo mode is explicit. Existing resources, custom domains, backup, and update remain open.
Remote Linux Docker Compose	Existing Ubuntu/Debian host, authorized SSH account, and password or private key	Production data mode is the default, with generated secrets and a one-time setup token on the selected private-network endpoint; demo mode is explicit. If Engine or Compose is missing, Ranch Hand offers a bounded sudo-backed installation, starts Docker, grants user access, and reruns preflight. Ranch Hand verifies and streams the immutable image archive, verifies its exact runtime identity, and disables registry pulls. It does not install Linux, public ingress, or a proxy; backup and update remain manual.

Ranch Hand does not install Caddy or another proxy. Azure and Cloudflare use their native managed HTTPS. Both local Docker targets stay on Windows loopback. Remote Compose binds port 8080 on the selected private Linux address, verifies that URL from Windows, and rejects plain-HTTP public-IP targets.

Remove a managed deployment

Active local WSL Compose deployments expose Permanently remove deployment directly in Ranch Hand's managed-deployment inventory. It requires explicit data-deletion confirmation, revalidates exact ownership, removes the Compose project and persistent volume, and marks the inventory record uninstalled. Use the ownership-checked manual removal runbook for WSL retain-data removal and targets whose managed uninstall has not shipped. Manual target removal does not reconcile Ranch Hand's local catalog.

Workflow

After launching the verified candidate:

1. Leave Latest stable (recommended) selected, choose a target, and use Fetch available releases to load or refresh every compatible stable release. Latest prerelease lists the preview channel, while Specific version (advanced) accepts an exact immutable version. Select the desired release, then select Verify and cache release.
2. Enter the target's non-secret values and select Create bound plan.
3. Run Preflight and dry run and review every proposed action.
4. Supply the target credential in memory and run Run live target preflight.
5. Read and accept the Public Preview boundary, then select the target's install action. Success requires readiness and the exact immutable release identity.

Plans and exported JSON never contain credentials. Runtime credentials are held only for the target operation and are excluded from the catalog, journals, and redacted diagnostics.

Local state and support

Ranch Hand stores its secret-free cache, plans, inventory, journals, and local backups below %LOCALAPPDATA%\WranglerLabs\Ranch Hand. Do not edit these files while an operation is active. Use Export redacted diagnostics in the Ranch Hand header when you need a support snapshot; review the file before sharing it.

What remains before GA

Ranch Hand reaches GA only after every required gate passes for the exact release artifact:

Gate	Required outcome
Trusted distribution	Approved SignPath/Authenticode signature and timestamp, verified publisher/signature/checksum/SBOM/provenance, revocation exercise, and stable channel
RepoWrangler compatibility	Install and manage the latest supported RepoWrangler patch; reject floating, unsupported, downgraded, or tampered inputs
Production configuration	Guided credentials, authentication, database, storage, domain/HTTPS, and target configuration without editing generated files
Target lifecycle parity	Ownership-safe backup, update, restore, rollback, repair, recovery, and uninstall on every GA target
Azure and cloud readiness	Integrated Azure sign-in; ACA PostgreSQL and supported resource/domain choices; complete Cloudflare production secrets/domain/lifecycle support
Compose readiness	Production local/remote configuration, complete lifecycle, and a documented trusted-ingress handoff for public remote deployments
Removal and retention	Explicit retain-data, export/backup-first, and permanent-delete choices with confirmations and ownership checks
Ranch Hand upgrades	Application and state upgrades preserve or migrate catalogs, plans, journals, installation records, backups, and compatibility contracts
UAT and accessibility	Clean supported Windows profiles, disposable real targets, failed-operation recovery, keyboard, screen reader, zoom, forced colors, reduced motion, and high-DPI tests
Security	Privileged-adapter review, least privilege, host-key rejection, tamper/downgrade/redaction tests, dependency review, CodeQL, and signed-artifact review
Documentation and support	Task-tested install/lifecycle/recovery/removal/manual-equivalence guides and a latest-version best-effort GA support matrix

A target remains Preview until its own production configuration, complete lifecycle, recovery/removal behavior, and real-target tests pass—even if Ranch Hand later reaches GA.

Future signed release

Until every gate above passes, the download remains Public Preview and the manual deployment alternative remains available.